FIDO FIDO Credential Lifecycle & Key Management

Question 1

In FIDO2, what type of cryptographic key pair is generated during the registration ceremony?

Accepted Answer

An asymmetric key pair where the private key never leaves the authenticator

Answer

A symmetric AES-256 key shared between authenticator and RP

Answer

A Diffie-Hellman ephemeral key pair used only for that session

Answer

A pre-shared key derived from the user's password via PBKDF2

Question 2

What is a 'resident credential' (discoverable credential) in FIDO2, and how does it differ from a non-resident credential?

Accepted Answer

A credential stored directly on the authenticator, enabling usernameless login without a credential ID hint

Answer

A credential stored in the cloud that can be discovered by any FIDO server

Answer

A credential issued by the FIDO Alliance that is pre-installed on certified devices

Answer

A credential that requires an internet connection to validate against an online key store

Question 3

How does a FIDO2 authenticator protect the private key from extraction in a software-based (platform) authenticator?

Accepted Answer

By storing it in a hardware-backed secure enclave such as TPM or Secure Enclave

Answer

By encrypting it with the user's password before storage

Answer

By splitting the key into shares distributed across multiple cloud services

Answer

By using a one-time-use key that is regenerated on every authentication

Question 4

What happens to a FIDO2 private key when a user deletes a passkey from their device?

Accepted Answer

It is permanently destroyed on the authenticator and the corresponding public key on the RP becomes unusable

Answer

It is archived in the FIDO Alliance key escrow service for recovery

Answer

It is transferred to a backup authenticator if one was previously registered

Answer

It is encrypted and stored in the user's cloud account for future restoration

Question 5

Which FIDO2 concept describes credentials that are synchronized across a user's devices via a cloud account (e.g., iCloud Keychain, Google Password Manager)?

Accepted Answer

Synced passkeys

Answer

Roaming authenticator credentials

Answer

Cross-origin credential delegation

Answer

Federated FIDO tokens

Question 6

What security consideration arises specifically from synced passkeys that does not apply to hardware-bound (device-bound) passkeys?

Accepted Answer

The private key material travels across a network, so cloud account security becomes part of the threat model

Answer

Synced passkeys cannot perform user verification

Answer

Synced passkeys do not support the ES256 algorithm

Answer

Only enterprise-managed devices can use synced passkeys